I have one of the V380 cameras. It did not have telnet or RTSP open, however, I was able to get RTSP with the ceshi.ini file contents mentioned above (just the rtsp=1 line). For telnet (as well as any arbitrary code) I created my own patch using GitHub - bcaller/v380-ipcam-firmware-patch: Write patches for the WiFi Smart Net Camera (v380) that runs a script on the sdcard when it “updates” the firmware, and then resets the sdcard files back to the preupdate state so the next time the camera powers up it will perform the “update” again, thus running the script. For my script I just have it starting telnet in the background, but I can change the script to do whatever without recreating a new patch.
To set this up, you need to get the patchv380 linux executable from the github link above. At the bottom of the readme he has a link to his blog post where he describes the update process in more detail, if you are interested. The create two files: exshell_bfu.sh and exshell_afu.sh.
cp /mnt/sdcard/local_update.conf /mnt/sdcard/local_update.bak
chmod +x /mnt/sdcard/run.sh
This runs at the start of the update and makes a copy of the local_update.conf file because the update process deletes it (in my experience). Then it makes sure a script named run.sh exists and is executable and runs it.
mv /mnt/sdcard/local_update.bak /mnt/sdcard/local_update.conf
rm -f /mnt/sdcard/update_record
This runs after the update completes (but before the update process changes the files) and waits for 30 seconds, then puts the local_update.conf back in place and deletes the update_record file that the camera creates to know the update happened. Basically, it puts things back the way they were so the camera will process the update again the next time it starts.
Create the patch file by running: ./patchv380 write exshell_bfu.sh exshell_afu.sh -h V380E2_C
It will output the md5 hash of the patch and create the patch file of the same name. The -h V380E2_C argument is optional but needs to be correct for your camera otherwise the update will not run. The github mentions V380E2_C and V380E2_CA, but for me I had to use V380E2_C2 for it to work. If none of those work for you, you can always open up the camera and connect a USB serial to the TX and GND probe points on the camera board and see what the camera says when booting up. It will tell you that the hwname doesn’t match and what it needs to be.
Put the patch file on your sdcard in a directory named updatepatch and create a local_update.conf file on the sdcard (not in the updatepatch directory). That contains your patch md5 hash.
Also create a run.sh script on the sd card that contains your code you want to run for the update. Anything in the run.sh script that will take a while to execute should be backgrounded, otherwise the update will never complete, the camera will never connect, the files will never be put back to start the update again, etc. For my run.sh script to get a root telnet session, I used busybox telnetd instead of just telnetd because the plain telnetd did not seem to connect properly. The below just starts telnetd on port 23 with an sh shell as root (because thats what the update runs as).
busybox telnetd -p 23 -l /bin/sh &
Thats about it. Like I said you can put anything in the run.sh file and you don’t need to recreate the patch to change the run.sh code.